Function at 0x4933e3
Capabilities:
Check if file exists
Create thread
Get common file path
Persist via app paths registry key
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push 0xe40
mov eax, 0x533788
call fcn.004fc76d
and dword [ebp - 0xcf8], 0
mov ebx, dword [ebp + 8]
and dword [ebp - 4], 0
mov esi, edx
xor edx, edx
inc edx
mov edi, ecx
mov dword [ebp - 0xcec], esi
mov dword [ebp - 0xd04], edx
test ebx, ebx
je 0x49348d
mov eax, dword [ebx]
mov ecx, 0x4c42444d
cmp eax, ecx
ja 0x4947eb
je 0x494619
mov ecx, 0x1f9
cmp eax, ecx
ja 0x493d3f
je 0x493d35
cmp eax, 0x25
ja 0x4938e4
cmp eax, 0x24
jae 0x4938af
cmp eax, 0x16
ja 0x4935ea
je 0x4935dc
dec eax
je 0x4935b9
dec eax
dec eax
je 0x49351d
sub eax, 0xa
je 0x4934d9
sub eax, 4
je 0x4934a4
dec eax
dec eax
je 0x49349b
dec eax
dec eax
jne 0x495879
push edx
mov ecx, edi
call fcn.00498862
mov eax, dword [ebp - 0xd04]
call fcn.004fc7c9
ret 4
mov esi, edi
call fcn.0049c7e4
jmp 0x49348d
push 0
push str.Q360InternationSafeClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4934c2
push 1
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0x3e8
push 0x452
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x49348d
cmp dword [ebx + 4], 0x410
jne 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
mov esi, 0x208
push esi
push ebx
call fcn.004f1d8a
pop ecx
pop ecx
cmp eax, esi
jae 0x49348d
push ebx
lea eax, [ebp - 0xd18]
push eax
call fcn.004056ee
lea eax, [ebp - 0xd18]
push eax
mov byte [ebp - 4], 0x17
call fcn.00498e22
jmp 0x4942fd
cmp dword [0x593800], 0
je 0x49353c
mov eax, dword [0x59376c]
test eax, eax
je 0x49348d
push 0
push 3
jmp 0x494f8c
push edx
push edx
lea eax, [ebp - 0xe10]
call fcn.00413959
pop ecx
pop ecx
push str.galaxy.dat
push eax
lea eax, [ebp - 0xa54]
push eax
mov byte [ebp - 4], 4
call fcn.00422e08
add esp, 0xc
push 0
push 1
lea esi, [ebp - 0xe10]
mov byte [ebp - 4], 6
call fcn.00404e29
cmp dword [ebp - 0xa3c], 8
mov edi, dword [ebp - 0xa50]
jae 0x49358c
lea edi, [ebp - 0xa50]
call fcn.0048ccc1
push edi
mov esi, eax
call fcn.00418c7e
call fcn.0048ccc1
mov ecx, eax
call fcn.0041921f
lea esi, [ebp - 0xa54]
push 0
push 1
call fcn.00404e29
jmp 0x49348d
call fcn.0043bb76
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jne 0x4935d1
cmp dword [eax + 0x18], ecx
je 0x4935d1
call fcn.0043be13
mov ecx, dword [eax]
mov dword [ebp - 0xd04], ecx
jmp 0x49348d
push 1
mov esi, edi
call fcn.0049cd22
jmp 0x49348d
sub eax, 0x17
je 0x4938a8
dec eax
je 0x493863
sub eax, 6
je 0x49374e
sub eax, 3
je 0x49368f
dec eax
je 0x493647
dec eax
jne 0x495879
push dword [ebx + 4]
mov edi, dword [ebx + 8]
lea ecx, [ebp - 0xdf4]
call fcn.0043602a
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x1d
call fcn.004a2729
push 0
push 1
lea ecx, [ebp - 0xdf4]
call fcn.004051a5
jmp 0x49348d
mov eax, dword [ebx + 4]
test eax, eax
je 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
mov ecx, eax
and ecx, edx
cmp cl, 1
je 0x49348d
shr eax, 1
dec eax
push eax
push ebx
lea eax, [ebp - 0xdd8]
call fcn.00428d6c
push edi
mov byte [ebp - 4], 0x1c
call fcn.004a2292
lea esi, [ebp - 0xdd8]
jmp 0x4935ab
cmp dword [ebx + 4], 0x10
jne 0x49348d
cmp dword [ebx + 8], 0
je 0x49348d
push 2
mov esi, edi
call fcn.004a2670
test al, al
je 0x49348d
cmp dword [edi + 0x68c], 0
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
mov ebx, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xd10], ecx
mov dword [ebp - 0xd0c], eax
jne 0x493708
push 0x590f51
push 0x1f0
call fcn.004f5c13
pop ecx
pop ecx
mov dword [ebp - 0xcf8], eax
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x4936fc
mov esi, eax
call fcn.004bdbfd
jmp 0x4936fe
xor eax, eax
mov byte [ebp - 4], 0
mov dword [edi + 0x68c], eax
mov eax, dword [edi + 0x68c]
test eax, eax
je 0x49348d
mov dword [eax + 0x1e4], 1
mov edi, dword [edi + 0x68c]
mov eax, dword [ebp - 0xd10]
mov dword [edi + 0x1d0], eax
mov eax, dword [ebp - 0xd0c]
mov dword [edi + 0x1e0], ebx
mov dword [edi + 0x1d4], eax
call fcn.004ad2c6
jmp 0x49348d
cmp dword [ebx + 4], 0xc
jne 0x49348d
mov eax, dword [ebx + 8]
test eax, eax
je 0x49348d
cmp byte [edi + 0x6e0], 0
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0xcf8], ecx
mov dword [ebp - 0xd1c], eax
mov byte [ebp - 0xce5], 0
je 0x4937a9
cmp eax, dword [edi + 0x6ec]
jb 0x4937a2
ja 0x493799
cmp ebx, dword [edi + 0x6e8]
jb 0x4937a2
mov byte [ebp - 0xce5], 1
jmp 0x4937b6
mov byte [ebp - 0xce5], 0
cmp byte [edi + 0x6d5], 0
je 0x493842
push 0
mov esi, edi
call fcn.004a2670
test al, al
je 0x493842
cmp dword [edi + 0x688], 0
jne 0x493800
push 0x590f51
push 0x1f0
call fcn.004f5c13
pop ecx
pop ecx
mov dword [ebp - 0xd0c], eax
mov byte [ebp - 4], 0x1b
test eax, eax
je 0x4937f4
mov esi, eax
call fcn.004bdbfd
jmp 0x4937f6
xor eax, eax
mov byte [ebp - 4], 0
mov dword [edi + 0x688], eax
mov eax, dword [edi + 0x688]
test eax, eax
je 0x493842
push dword [ebp - 0xd1c]
movzx ecx, word [edi + 0x6d6]
push ebx
push dword [ebp - 0xcf8]
push dword [edi + 0x6dc]
push dword [edi + 0x6d8]
push ecx
mov cl, byte [edi + 0x6d5]
push eax
mov al, byte [ebp - 0xce5]
call fcn.004bdca5
jmp 0x49348d
push 0
push str.Q360InternationSafeClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x49348d
push 1
push 0
push 0x10
push eax
jmp 0x495337
mov ecx, dword [0x59376c]
test ecx, ecx
je 0x49348d
xor eax, eax
lea edi, [ebp - 0xcfc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebx + 8]
push ecx
lea ecx, [ebp - 0xd00]
mov dword [ebp - 0xd00], 0x18
mov dword [ebp - 0xcf8], eax
call fcn.0048bda5
jmp 0x49348d
push 8
jmp 0x4935de
mov ecx, dword [0x59376c]
test ecx, ecx
je 0x49348d
cmp eax, 0x24
jne 0x4938c9
mov eax, 0x7e9
jmp 0x4938d7
cmp eax, 0x25
jne 0x49348d
mov eax, 0x7ea
push 0
push eax
push 0xc34
jmp 0x4946a0
mov ecx, 0x191
cmp eax, ecx
ja 0x493c43
je 0x493c20
sub eax, 0x26
je 0x493bab
sub eax, 0xd
je 0x493a6b
dec eax
je 0x493a5f
sub eax, 0xfe
je 0x4939bc
sub eax, 0x37
je 0x493949
sub eax, 0x27
jne 0x495879
add edi, 0x65c
mov eax, edi
call fcn.004aab30
push 1
call fcn.004aaf5b
pop ecx
push edi
call fcn.004aae75
jmp 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
mov eax, dword [0x59376c]
mov byte [ebp - 0xce4], 0
test eax, eax
je 0x49348d
cmp dword [ebx], 0xc3
jne 0x493977
mov byte [ebp - 0xce4], 1
push dword [ebp - 0xce4]
push eax
call fcn.0048b800
cmp eax, 1
jne 0x49348d
xor eax, eax
cmp byte [ebp - 0xce4], al
push eax
push 0x1f4
push eax
push eax
sete al
push eax
push 0x552958
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push eax
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
jmp 0x49348d
mov edi, dword [ebx + 8]
call fcn.0048f25f
test al, al
je 0x493a19
lea eax, [edi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0xce4]
push eax
call fcn.004056ee
push 0x53a3d8
push dword [ebp - 0xce4]
call fcn.004f5171
pop ecx
pop ecx
test eax, eax
je 0x493a36
push str.360ExtremeBrowser.exe
push dword [ebp - 0xce4]
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x493a36
mov eax, dword [ebp - 0xce4]
add eax, 0xfffffff0
call fcn.00405521
test edi, edi
je 0x49348d
cmp dword [edi], 1
jne 0x49348d
and dword [ebp - 0xd04], 0
jmp 0x49348d
lea eax, [ebp - 0xd04]
push eax
push 0xbb8
push 2
push ebx
push esi
push 0x4a
push dword [0x5937f0]
mov dword [ebx], 0x7e010306
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
jmp 0x493b47
mov ecx, edi
call fcn.004a2c16
jmp 0x49348d
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0xce4], ebx
xor eax, eax
push 0x206
mov byte [ebp - 4], 1
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.004f18b0
add esp, 0xc
push str.config.ini
push 0x593e48
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x493b05
push 0x40
lea esi, [ebp - 0xce4]
call fcn.00405612
lea ecx, [ebp - 0x220]
push ecx
push 0x40
push eax
push 0x5481bc
push str.language
push 0x547bc0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or eax, 0xffffffff
call fcn.00428e0c
mov ebx, dword [ebp - 0xce4]
cmp dword [ebx - 0xc], 0
jne 0x493b18
lea eax, [ebx - 0x10]
call fcn.00405521
jmp 0x49348d
lea esi, [ebp - 0xd2c]
call fcn.0043b46a
push dword [eax]
push ebx
call fcn.004f52b9
mov ebx, eax
mov eax, dword [ebp - 0xd2c]
neg ebx
pop ecx
sbb bl, bl
pop ecx
add eax, 0xfffffff0
inc bl
call fcn.00405521
test bl, bl
je 0x493b52
mov eax, dword [ebp - 0xce4]
add eax, 0xfffffff0
jmp 0x493b0e
call fcn.0049e577
mov eax, dword [0x59376c]
test eax, eax
je 0x493b9a
lea ecx, [ebp - 0xd00]
push ecx
push 0
push 0x4a
push dword [0x59459c]
mov ecx, str.Q360SafeMonClass
push eax
mov dword [ebp - 0xd00], 0x45584954
mov dword [ebp - 0xcf8], str.swchlan
mov dword [ebp - 0xcfc], 8
call fcn.0048bfb0
push 0
push 0x7fff7e
push 0x64
push edi
call fcn.00491d89
jmp 0x493b47
cmp esi, 0xfffe
jne 0x49348d
cmp dword [ebx + 4], 8
jne 0x49348d
mov eax, dword [ebx + 8]
test eax, eax
je 0x49348d
push 8
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x49348d
mov eax, dword [ebx + 8]
mov eax, dword [eax]
xor ecx, ecx
mov dword [ebp - 0xa78], ecx
mov dword [ebp - 0xa70], ecx
mov dword [ebp - 0xa6c], ecx
mov dword [ebp - 0xa68], ecx
mov dword [ebp - 0xa64], ecx
mov dword [ebp - 0xa60], ecx
push eax
lea ecx, [ebp - 0xa78]
call fcn.0043d87f
mov eax, dword [ebp - 0xa60]
pop ecx
jmp 0x4947a9
cmp dword [ebx + 4], 4
jne 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
push dword [ebx]
mov ecx, edi
call fcn.0049ec53
jmp 0x49348d
sub eax, 0x192
je 0x493d15
sub eax, 0x62
je 0x493cbb
dec eax
dec eax
je 0x493ca8
dec eax
je 0x493c86
dec eax
jne 0x495879
cmp dword [ebx + 4], 0x2d0
jne 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
push ebx
mov ecx, edi
call fcn.004a20d2
jmp 0x49348d
cmp dword [ebx + 4], 0x30
jne 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
push edi
mov edi, ebx
call fcn.004a1e98
jmp 0x49348d
push edi
mov eax, ebx
mov dword [ebx], 0x1f4
call fcn.0049cc9a
jmp 0x494fdc
push edi
mov eax, ebx
call fcn.0049cc9a
test eax, eax
je 0x49348d
mov eax, dword [0x59376c]
mov esi, eax
test eax, eax
je 0x49348d
push ebx
push eax
call fcn.0048be82
cmp eax, 1
jne 0x493a2a
xor eax, eax
lea edi, [ebp - 0xcfc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0xd00], 0x1f6
mov dword [ebp - 0xcf8], eax
jmp 0x495043
cmp dword [ebx + 4], 4
jne 0x49348d
cmp dword [ebx + 8], 0
je 0x49348d
mov ecx, edi
call fcn.0049e927
jmp 0x49348d
call fcn.004a2140
jmp 0x49348d
mov ecx, 0x444e5343
cmp eax, ecx
ja 0x494637
je 0x49476e
mov esi, 0x43505552
cmp eax, esi
ja 0x4945df
je 0x4941ce
mov ecx, 0x41505343
cmp eax, ecx
ja 0x4941b8
je 0x493f61
cmp eax, 0x259
jb 0x495879
cmp eax, 0x25a
jbe 0x495897
cmp eax, 0x322
jbe 0x495879
cmp eax, 0x326
jbe 0x493f4a
cmp eax, 0x534258
jne 0x495879
cmp dword [0x593800], 0
je 0x495324
cmp dword [ebx + 4], 0x210
jne 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
xor eax, eax
mov word [ebx + 0x20a], ax
add ebx, 4
push ebx
call fcn.0040d996
pop ecx
test al, al
jne 0x493e49
push ebx
call fcn.0040dddc
pop ecx
test al, al
jne 0x493e49
push ebx
lea eax, [ebp - 0xa54]
call fcn.004043d1
push 0x53a3d8
lea eax, [ebp - 0xa74]
mov byte [ebp - 4], 0x10
call fcn.004043d1
mov byte [ebp - 4], 0x11
mov eax, dword [0x59376c]
test eax, eax
je 0x493e35
push eax
lea edx, [ebp - 0xa74]
lea ecx, [ebp - 0xa54]
call fcn.0048bbda
push 0
push 1
lea esi, [ebp - 0xa74]
call fcn.00404e29
jmp 0x4935a5
push 0
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
lea eax, [ebp - 0xce0]
push eax
call fcn.004522c2
push ecx
mov byte [ebp - 4], 0xe
mov eax, esp
mov dword [ebp - 0xcf8], esp
push ecx
xor edi, edi
mov dword [eax], edi
mov eax, esp
mov dword [ebp - 0xcf8], esp
push esi
lea esi, [ebp - 0xcb4]
mov dword [eax], edi
call fcn.00454766
cmp eax, edi
je 0x493f35
push edi
push str.IDS_TRAP_TIP
push 0xffffffffffffffff
lea ecx, [ebp - 0xe48]
call fcn.0043e727
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x493eb5
mov eax, dword [eax + 4]
jmp 0x493eb8
add eax, 4
push eax
push dword [ebp - 0xcb0]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
push 1
lea esi, [ebp - 0xe48]
call fcn.00404e29
lea eax, [ebp - 0xce0]
push eax
call fcn.00453dd8
push edi
push str.IDS_SYS_EXE_NOT_IN_SB
push 0xffffffffffffffff
lea ecx, [ebp - 0xe2c]
call fcn.0043e727
add esp, 0xc
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x18], 8
jb 0x493f04
mov eax, dword [eax + 4]
jmp 0x493f07
add eax, 4
push edi
mov edx, eax
lea ecx, [ebp - 0xce0]
call fcn.00453af7
push edi
push 1
lea esi, [ebp - 0xe2c]
mov byte [ebp - 4], 0xe
call fcn.00404e29
push edi
push 1
lea esi, [ebp - 0xce0]
call fcn.00453a1b
lea eax, [ebp - 0xce0]
push eax
mov byte [ebp - 4], 0
call fcn.0045241d
jmp 0x49348d
mov ecx, dword [0x59376c]
test ecx, ecx
je 0x49348d
push 0
push eax
push ecx
jmp 0x494f8d
mov ecx, dword [ebx + 4]
cmp ecx, 4
jne 0x494147
mov eax, dword [ebx + 8]
mov dword [ebp - 0xce4], eax
test eax, eax
je 0x494147
mov eax, dword [0x59376c]
mov dword [ebp - 0xcec], eax
test eax, eax
je 0x49413c
mov esi, dword [ebp - 0xce4]
mov eax, pe_nt_image_headers32
test dword [esi], eax
je 0x493fb3
push eax
call fcn.0044fe08
pop ecx
push eax
push dword [ebp - 0xcec]
call fcn.0048b704
mov eax, 0x200
test dword [esi], eax
je 0x493fcf
push eax
call fcn.0044fe08
pop ecx
push eax
push dword [ebp - 0xcec]
call fcn.0048b782
mov eax, 0x400
test dword [esi], eax
je 0x493ffd
push eax
call fcn.0044fe08
xor esi, esi
pop ecx
xor ecx, ecx
inc esi
cmp al, 1
jne 0x493fea
mov ecx, esi
push 0
push ecx
push esi
push 3
push dword [ebp - 0xcec]
call fcn.0048b882
jmp 0x494000
xor esi, esi
inc esi
mov ebx, dword [ebp - 0xce4]
mov eax, 0x800
test dword [ebx], eax
je 0x49402f
push eax
call fcn.0044fe08
pop ecx
xor ecx, ecx
cmp al, 1
jne 0x49401e
mov ecx, esi
push 0
push ecx
push esi
push 4
push dword [ebp - 0xcec]
call fcn.0048b882
mov eax, 0x1000
test dword [ebx], eax
je 0x494058
push eax
call fcn.0044fe08
pop ecx
xor ecx, ecx
cmp al, 1
jne 0x494047
mov ecx, esi
push 0
push ecx
push esi
push 5
push dword [ebp - 0xcec]
call fcn.0048b882
mov eax, 0x2000
test dword [ebx], eax
je 0x494081
push eax
call fcn.0044fe08
pop ecx
xor ecx, ecx
cmp al, 1
jne 0x494070
mov ecx, esi
push 0
push ecx
push esi
push 6
push dword [ebp - 0xcec]
call fcn.0048b882
mov eax, 0x10000000
test dword [ebx], eax
je 0x4940d8
push eax
call fcn.0044fe08
mov bl, al
xor eax, eax
pop ecx
cmp bl, 1
jne 0x49409c
mov eax, esi
and dword [ebp - 0xd18], 0
lea ecx, [ebp - 0xd18]
push ecx
push eax
push esi
push 7
push dword [ebp - 0xcec]
call fcn.0048b882
cmp bl, 1
jne 0x4940d8
push 0
push dword [ebp - 0xd18]
push 0x18aa0
push str.Q360InternationSafeClass
call fcn.0043bf00
add esp, 0x10
mov eax, dword [ebp - 0xce4]
test dword [eax], 0x20000000
je 0x4940ed
mov esi, edi
call fcn.0049cce2
mov ebx, dword [ebp - 0xce4]
test dword [ebx], 0x530000
je 0x49410e
push 0
push 0
push 1
push 8
push dword [ebp - 0xcec]
call fcn.0048b882
test dword [ebx], 0x13f00
je 0x49413c
mov esi, dword [0x59376c]
test esi, esi
je 0x49413c
call fcn.004c3106
xor ecx, ecx
test al, al
setne cl
push 0
mov eax, ecx
push eax
push 0xbd3
push esi
call fcn.0048b9de
push 1
mov esi, edi
call fcn.0049cd22
jmp 0x4941ae
cmp ecx, 8
jne 0x4941ae
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4941ae
cmp dword [ebx], ecx
jne 0x4941ae
mov eax, dword [0x59376c]
mov esi, eax
test eax, eax
je 0x4941ae
mov eax, 0x593e48
call fcn.0044a435
test al, al
jne 0x494185
call int.0040b2f7
push 0
call fcn.0047795e
cmp eax, 1
je 0x494185
xor al, al
jmp 0x494187
mov al, 1
test byte [ebx + 4], 1
je 0x4941ae
test al, al
je 0x49419f
call fcn.0044fe5a
test al, al
je 0x49419f
xor eax, eax
inc eax
jmp 0x4941a1
xor eax, eax
push 0
push eax
push 1
push 0xa
push esi
call fcn.0048b882
call fcn.004982fd
jmp 0x49348d
cmp eax, 0x434c4541
je 0x49427f
cmp eax, 0x43504d52
jne 0x495879
mov eax, 0xd0
cmp dword [ebx + 4], eax
jne 0x49348d
mov edi, dword [ebx + 8]
test edi, edi
je 0x49348d
cmp dword [edi], eax
jne 0x49348d
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0xcec]
push eax
call fcn.004056ee
mov byte [ebp - 4], 7
mov edi, dword [edi + 0xcc]
test edi, edi
jne 0x4943ca
mov ebx, dword [ebx]
cmp ebx, 0x43504d52
jne 0x494308
xor esi, esi
push esi
push dword [ebp - 0xcec]
push ecx
mov eax, esp
mov dword [ebp - 0xcf8], esp
push str.onlinever
push eax
call fcn.004056ee
push ecx
mov byte [ebp - 4], 8
mov eax, esp
mov dword [ebp - 0xd0c], esp
push str.SOFTWARE360TotalSecurityUpdate
push eax
call fcn.004056ee
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0xd90]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.0040499a
push eax
call fcn.00404a80
add esp, 0xc
lea esi, [ebp - 0xd90]
jmp 0x4945a8
mov eax, dword [0x59376c]
mov ebx, eax
test eax, eax
je 0x49348d
lea eax, [ebp - 0xd18]
push eax
call fcn.004498f8
pop ecx
xor eax, eax
mov byte [ebp - 4], 2
lea edi, [ebp - 0xcc8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x208
stosw word es:[edi], ax
lea eax, [ebp - 0xcbe]
push 0
push eax
call fcn.004f18b0
add esp, 0xc
lea eax, [ebp - 0xcc8]
push eax
push 0xa
mov edx, 0x552950
pop ecx
call fcn.0043fd87
push dword [ebp - 0xd18]
lea edx, [ebp - 0xcbe]
push 0x104
call fcn.0042a4a0
mov eax, dword [ebx]
push 0x212
lea ecx, [ebp - 0xcc8]
push ecx
mov ecx, ebx
call dword [eax]
mov eax, dword [ebp - 0xd18]
jmp 0x493b4d
cmp ebx, esi
jne 0x4945ad
xor esi, esi
push esi
push dword [ebp - 0xcec]
push ecx
mov eax, esp
mov dword [ebp - 0xcf8], esp
push str.manualver
push eax
call fcn.004056ee
push ecx
mov byte [ebp - 4], 9
mov eax, esp
mov dword [ebp - 0xd0c], esp
mov ebx, str.SOFTWARE360TotalSecurityUpdate
push ebx
push eax
call fcn.004056ee
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea eax, [ebp - 0xd70]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.0040499a
push eax
call fcn.00404a80
add esp, 0xc
lea esi, [ebp - 0xd70]
call fcn.00401105
xor esi, esi
push esi
push dword [ebp - 0xcec]
push ecx
mov eax, esp
mov dword [ebp - 0xcf8], esp
push str.onlinever
push eax
call fcn.004056ee
push ecx
mov byte [ebp - 4], 0xa
mov eax, esp
mov dword [ebp - 0xd0c], esp
push ebx
push eax
call fcn.004056ee
push edi
lea eax, [ebp - 0xda0]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.0040499a
push eax
call fcn.00404a80
add esp, 0xc
lea esi, [ebp - 0xda0]
jmp 0x4945a8
cmp edi, 1
jne 0x4945ad
xor eax, eax
mov dword [ebp - 0xce4], eax
mov dword [ebp - 0xd28], eax
mov dword [ebp - 0xd24], eax
mov dword [ebp - 0xd18], eax
lea eax, [ebp - 0xd18]
push eax
lea eax, [ebp - 0xd24]
push eax
lea eax, [ebp - 0xd28]
push eax
lea eax, [ebp - 0xce4]
push eax
push str._d._d._d._d
push dword [ebp - 0xcec]
call fcn.004f7640
mov ebx, eax
add esp, 0x18
cmp ebx, 4
je 0x494454
lea eax, [ebp - 0xd18]
push eax
lea eax, [ebp - 0xd24]
push eax
lea eax, [ebp - 0xd28]
push eax
lea eax, [ebp - 0xce4]
push eax
push 0x54f7c4
push dword [ebp - 0xcec]
call fcn.004f7640
add esp, 0x18
mov ebx, eax
and dword [ebp - 0xd0c], 0
and dword [ebp - 0xcf8], 0
lea edi, [ebp - 0xd34]
call fcn.00404523
lea ecx, [ebp - 0xd30]
push 0x549698
push ecx
mov edi, eax
mov byte [ebp - 4], 0xb
call fcn.00405a46
mov edi, dword [eax]
pop ecx
pop ecx
lea eax, [ebp - 0xcf8]
push eax
lea eax, [ebp - 0xd0c]
push eax
call fcn.0040b3b3
movzx esi, al
mov eax, dword [ebp - 0xd30]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00405521
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xd34]
add eax, 0xfffffff0
call fcn.00405521
test esi, esi
je 0x4945ad
cmp ebx, 4
jne 0x4945ad
mov eax, dword [ebp - 0xce4]
mov ecx, dword [ebp - 0xd24]
shl eax, 0x10
add eax, dword [ebp - 0xd28]
shl ecx, 0x10
add ecx, dword [ebp - 0xd18]
cmp eax, dword [ebp - 0xd0c]
ja 0x4945ad
jb 0x494509
cmp ecx, dword [ebp - 0xcf8]
ja 0x4945ad
push ecx
mov eax, esp
mov dword [ebp - 0xcf8], esp
push str.manualver
push eax
xor esi, esi
call fcn.004056ee
push ecx
mov byte [ebp - 4], 0xc
mov eax, esp
mov dword [ebp - 0xd0c], esp
mov ebx, str.SOFTWARE360TotalSecurityUpdate
push ebx
push eax
call fcn.004056ee
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea eax, [ebp - 0xd60]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.0040499a
call fcn.004048f5
lea esi, [ebp - 0xd60]
call fcn.00401105
push ecx
mov eax, esp
mov dword [ebp - 0xcf8], esp
push str.onlinever
push eax
xor esi, esi
call fcn.004056ee
push ecx
mov byte [ebp - 4], 0xd
mov eax, esp
mov dword [ebp - 0xd0c], esp
push ebx
push eax
call fcn.004056ee
push edi
lea eax, [ebp - 0xd80]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.0040499a
call fcn.004048f5
lea esi, [ebp - 0xd80]
call fcn.00401105
push 0
mov esi, str.Q360InternationSafeClass
push esi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4945d4
push 0
push 0xff
push 0x789
push esi
call fcn.0043bf00
add esp, 0x10
mov eax, dword [ebp - 0xcec]
jmp 0x493b4d
cmp eax, 0x43524552
je 0x494f63
cmp eax, 0x44415649
je 0x494619
cmp eax, 0x44424449
je 0x494619
cmp eax, 0x44454c46
je 0x494f63
cmp eax, 0x44484d52
je 0x494f63
cmp eax, 0x444b5049
jne 0x495879
lea eax, [ebp - 0xcf8]
push eax
call fcn.004bb01f
pop ecx
test eax, eax
je 0x49348d
push 0
push dword [ebx]
jmp 0x4947e0
mov edx, 0x47414d45
cmp eax, edx
ja 0x4947b4
je 0x49477a
cmp eax, 0x444e5354
je 0x494736
cmp eax, 0x44524452
je 0x49471f
cmp eax, 0x45584544
je 0x4946cc
cmp eax, 0x45584954
je 0x4946ab
cmp eax, 0x46524453
je 0x494680
cmp eax, 0x46524553
jne 0x495879
mov ecx, dword [0x59376c]
test ecx, ecx
je 0x49348d
xor edx, edx
cmp eax, 0x46524553
jne 0x494698
inc edx
push edx
push 0x64
push 0xbd2
push ecx
call fcn.0048b9de
jmp 0x49348d
cmp byte [0x59378c], 0
je 0x49348d
push 1
push 0x7fff7f
push 0x64
push edi
call fcn.00491d89
jmp 0x49348d
cmp dword [ebx + 4], 4
jne 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
mov ebx, dword [ebx]
cmp ebx, 1
jne 0x4946ef
push str.SOFTWARE360TotalSecurityChrome
jmp 0x494715
cmp ebx, 2
jne 0x4946fb
push str.SOFTWARE360TotalSecurityOpera
jmp 0x494715
cmp ebx, 3
jne 0x494707
push str.SOFTWARE360TotalSecurityYandex
jmp 0x494715
cmp ebx, 6
jne 0x49348d
push 0x53b888
call fcn.0041422f
jmp 0x49515a
mov eax, dword [0x59376c]
test eax, eax
je 0x49348d
push dword [ebx + 8]
push 2
jmp 0x494f8c
mov eax, dword [0x59376c]
xor edx, edx
cmp eax, edx
je 0x49476e
mov dword [ebp - 0xd00], ecx
lea ecx, [ebp - 0xd00]
push ecx
push edx
push 0x4a
push dword [0x59459c]
mov ecx, str.Q360SafeMonClass
push eax
mov dword [ebp - 0xcf8], edx
mov dword [ebp - 0xcfc], edx
call fcn.0048bfb0
mov eax, edi
call fcn.0049ae3f
jmp 0x49348d
xor ebx, ebx
call fcn.00449525
add edi, 0x24
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x24]
test eax, eax
je 0x4947a2
push str.true
push eax
call fcn.004f5171
pop ecx
pop ecx
test eax, eax
jne 0x4947a2
inc ebx
xor eax, eax
test ebx, ebx
setne al
mov dword [ebp - 0xd04], eax
jmp 0x49348d
mov ecx, eax
sub ecx, 0x4c415649
je 0x4947dd
sub ecx, 4
je 0x494619
sub ecx, 5
je 0x4947dd
sub ecx, 0xedf4
je 0x4947dd
sub ecx, 3
jne 0x495879
push 0
push eax
push edi
call fcn.00499863
jmp 0x49348d
mov ecx, 0x53435354
cmp eax, ecx
ja 0x4951a5
je 0x495160
mov ecx, 0x504f5057
cmp eax, ecx
ja 0x494f12
je 0x493a2a
mov ecx, 0x4c534d4c
cmp eax, ecx
ja 0x494ac6
je 0x494970
mov ecx, eax
sub ecx, 0x4c434e4c
je 0x494619
sub ecx, 0x607f9
je 0x4947dd
sub ecx, 0x1fa01
je 0x4947dd
sub ecx, 3
je 0x4947dd
sub ecx, 0x40003
je 0x494951
sub ecx, 0x3fbfc
jne 0x495879
xor eax, eax
push 0x208
mov word [ebp - 0xcc0], ax
xor esi, esi
lea eax, [ebp - 0xcbe]
push esi
push eax
call fcn.004f18b0
add esp, 0xc
lea eax, [ebp - 0xd18]
push eax
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0xd24]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xd18], 0x209
mov dword [ebp - 0xd24], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49348d
push 0x206
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push esi
push eax
call fcn.004f18b0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push 0x23
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x49348d
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xcf8], eax
push str.360TotalSecurityDesktopPlusUtils360searchlite.exe
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xcf8]
push 0x54823c
push eax
mov byte [ebp - 4], 0x1e
call fcn.0040450f
add esp, 0x10
push esi
push 5
push esi
mov esi, dword [ebp - 0xcf8]
mov eax, esi
call fcn.0044972a
add esp, 0xc
lea eax, [esi - 0x10]
jmp 0x493b0e
cmp dword [edi + 0x2ec], 0
jne 0x49348d
push ebx
add edi, 0x370
push edi
call fcn.0047b84e
jmp 0x49348d
and dword [ebp - 0xcf8], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.004f18b0
add esp, 0xc
push str.softmgrSMLSoftMgrLite.exe
push 0x593e48
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x220]
push eax
call fcn.0040595b
pop ecx
test eax, eax
je 0x494ab5
mov eax, dword [0x59376c]
mov dword [ebp - 0xd0c], eax
test eax, eax
je 0x494ab5
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xa54]
call fcn.004043d1
mov byte [ebp - 4], 0x1f
cmp dword [ebp - 0xa3c], 8
mov eax, dword [ebp - 0xa50]
jae 0x4949ff
lea eax, [ebp - 0xa50]
push eax
lea eax, [ebp - 0xcb8]
push 0x53c29c
push eax
call fcn.0047c94c
add esp, 0xc
mov esi, 0x53a3d8
push esi
call fcn.004f192a
pop ecx
push esi
lea esi, [ebp - 0xa54]
call fcn.00404d75
lea eax, [ebp - 0xcb8]
push eax
lea eax, [ebp - 0xa74]
call fcn.004043d1
xor ebx, ebx
mov byte [ebp - 4], 0x20
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edi, edi
inc ebx
cmp edi, ebx
jl 0x494a58
push 0x64
call sub.KERNEL32.dll_Sleep
push 0
push ecx
call esi
push eax
call fcn.0040df4f
pop ecx
pop ecx
xor ecx, ecx
test al, al
setne cl
inc ecx
inc ecx
push ecx
call esi
push eax
push dword [ebp - 0xd0c]
lea ecx, [ebp - 0xa74]
lea edx, [ebp - 0xa54]
call fcn.0048bec5
inc edi
mov dword [ebp - 0xcf8], eax
cmp eax, ebx
je 0x494a99
cmp edi, 3
jl 0x494a4d
push 0
push ebx
lea esi, [ebp - 0xa74]
call fcn.00404e29
push 0
push ebx
lea esi, [ebp - 0xa54]
call fcn.00404e29
xor eax, eax
cmp dword [ebp - 0xcf8], 1
sete al
jmp 0x4947a9
cmp eax, 0x4d47534d
je 0x494d2d
cmp eax, 0x4d524853
je 0x4952ed
cmp eax, 0x4e534f4e
je 0x495324
cmp eax, 0x4f505343
je 0x494bf0
cmp eax, 0x50455432
je 0x494b59
cmp eax, 0x50455654
jne 0x495879
mov eax, dword [ebx + 8]
test eax, eax
je 0x49348d
cmp dword [ebx + 4], 0x418
jne 0x49348d
xor ecx, ecx
mov word [eax + 0x416], cx
mov edi, dword [edi + 0x97c]
test edi, edi
je 0x49348d
cmp dword [edi], 0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
je 0x49348d
mov edi, dword [edi + 4]
test edi, edi
je 0x49348d
push ecx
push edx
add eax, 8
push eax
call edi
jmp 0x49348d
mov eax, dword [ebx + 8]
test eax, eax
je 0x49348d
cmp dword [ebx + 4], 0x104c
jb 0x49348d
xor ecx, ecx
mov word [eax + 0x416], cx
mov word [eax + 0x826], cx
mov word [eax + 0xc3a], cx
mov word [eax + 0x104a], cx
mov edi, dword [edi + 0x97c]
test edi, edi
je 0x49348d
cmp dword [edi], 0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
lea ebx, [eax + 8]
je 0x49348d
mov esi, dword [edi + 8]
test esi, esi
je 0x494bdd
push 0
push 0
push ecx
lea ecx, [eax + 0xc3c]
push ecx
lea ecx, [eax + 0x418]
push ecx
push dword [eax + 0x828]
add eax, 0x82c
push edx
push eax
push ebx
call esi
jmp 0x49348d
mov edi, dword [edi + 4]
test edi, edi
je 0x49348d
push ecx
push edx
push ebx
jmp 0x494b52
mov eax, dword [0x59376c]
mov esi, eax
test eax, eax
je 0x494c38
push 0
push 0xcd
push 0x111
push dword [0x59459c]
mov ecx, str.Q360SafeMonClass
push eax
call fcn.0048bfb0
push ebx
push dword [ebp - 0xcec]
mov dword [ebx], 0x4d505343
push 0x4a
push dword [0x59459c]
mov ecx, str.Q360InternationSafeClass
push esi
call fcn.0048bfb0
push 0
push 0
call fcn.0044f993
pop ecx
pop ecx
test eax, eax
jne 0x494d1a
and dword [ebp - 0xd18], eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x49348d
cmp eax, str.ActiveProtection
je 0x49348d
mov ebx, str.CloseType
cmp eax, ebx
je 0x49348d
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xcf8], eax
push str.ActiveProtection
push esi
push str._s_s
lea eax, [ebp - 0xcf8]
mov byte [ebp - 4], 0x16
call fcn.0042ee4a
and dword [ebp - 0xd28], 0
add esp, 0xc
lea eax, [ebp - 0xd24]
push eax
lea eax, [ebp - 0xd18]
push eax
lea eax, [ebp - 0xd28]
push eax
push ebx
mov ebx, dword [ebp - 0xcf8]
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xd24], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebx - 0x10]
call fcn.00405521
mov eax, dword [ebp - 0xd18]
cmp eax, 1
je 0x494cfe
cmp eax, 2
jne 0x49348d
dec eax
neg eax
sbb eax, eax
and eax, 0x2932e0
push 0
add eax, 0xdbba0
push eax
push 0x70a
jmp 0x4934ce
push 0x70a
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x49348d
cmp dword [edi + 0x2ec], 0
jne 0x49348d
push 4
pop esi
cmp dword [ebx + 4], esi
jb 0x49348d
mov eax, dword [ebx + 8]
test eax, eax
je 0x49348d
and dword [ebp - 0xd0c], 0
push esi
push eax
lea eax, [ebp - 0xd0c]
push eax
call fcn.004f4830
add esp, 0xc
cmp dword [ebp - 0xd0c], 0x52545642
jne 0x494ee6
xor eax, eax
inc eax
push esi
mov word [ebp - 0xd50], ax
call fcn.004f1aab
pop ecx
test eax, eax
je 0x494d98
lea ecx, [ebp - 0xd4c]
mov dword [eax], ecx
jmp 0x494d9a
xor eax, eax
mov dword [ebp - 0xd4c], eax
xor edi, edi
mov dword [ebp - 0xd40], edi
mov dword [ebp - 0xd3c], edi
mov dword [ebp - 0xd38], edi
mov byte [ebp - 4], 0x22
mov eax, dword [ebx + 4]
sub eax, esi
push eax
mov eax, dword [ebx + 8]
add eax, esi
push eax
lea esi, [ebp - 0xab0]
call fcn.00429200
mov eax, esi
push eax
lea ecx, [ebp - 0xd50]
mov byte [ebp - 4], 0x23
call fcn.004a850a
test al, al
je 0x494ec8
push edi
lea ecx, [ebp - 0xa94]
mov dword [ebp - 0xa7c], 0xf
call fcn.0040526c
push str._type_
lea ecx, [ebp - 0xdbc]
mov byte [ebp - 4], 0x24
call fcn.0040531c
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0xdbc]
push eax
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0xd50]
mov dword [ebp - 0xcf8], 1
call fcn.004a7b77
test al, al
je 0x494e85
push str.msaashld
lea esi, [ebp - 0xa94]
call fcn.00426296
cmp eax, edi
je 0x494e7c
push str.dcomshld
call fcn.00426296
cmp eax, edi
je 0x494e7c
push str.lnkinfo
call fcn.00426296
cmp eax, edi
je 0x494e7c
push str.win10settingcontentms
call fcn.00426296
cmp eax, edi
jne 0x494e85
mov byte [ebp - 0xce5], 1
jmp 0x494e8c
mov byte [ebp - 0xce5], 0
push edi
push 1
lea ecx, [ebp - 0xdbc]
mov dword [ebp - 4], 0x24
call fcn.004051a5
cmp byte [ebp - 0xce5], 0
je 0x494eba
mov eax, dword [0x59376c]
cmp eax, edi
je 0x494eba
push ebx
push eax
call fcn.0048bcdf
push edi
push 1
lea ecx, [ebp - 0xa94]
call fcn.004051a5
push edi
push 1
lea ecx, [ebp - 0xab0]
call fcn.004051a5
lea esi, [ebp - 0xd4c]
call fcn.004a8638
jmp 0x49348d
cmp dword [ebp - 0xd0c], 0x414e5449
jne 0x49348d
cmp dword [ebx + 4], 0x120
jb 0x49348d
push dword [ebx + 8]
mov eax, edi
call fcn.0049302b
jmp 0x49348d
mov ecx, 0x524d4b50
cmp eax, ecx
ja 0x495068
je 0x494619
sub eax, 0x50536952
je 0x494ff7
dec eax
je 0x494fd2
sub eax, 0xf9ea01
je 0x494f97
sub eax, 0xf7fafb
je 0x494f7c
sub eax, 0x70101
je 0x494f56
sub eax, 0xf2f4
jmp 0x494613
cmp dword [edi + 0x2ec], 0
jne 0x49348d
mov eax, dword [0x59376c]
test eax, eax
je 0x49348d
push ebx
push eax
call fcn.0048bcdf
jmp 0x49348d
mov eax, dword [0x59376c]
test eax, eax
je 0x49348d
push 0
push edx
push eax
call fcn.0048b91c
jmp 0x49348d
call int.0040b2f7
xor esi, esi
push esi
call fcn.0047795e
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x49348d
cmp dword [0x5937a0], esi
jne 0x49348d
push esi
push dword [0x588754]
mov dword [0x5937a0], ecx
push 0x3f5
jmp 0x4934ce
push 1
push edi
mov edi, ebx
call fcn.0049cb16
push 0
push 0
push 0x6c4
push str.Q360BrowseringProtectionClass
call fcn.0043bf00
add esp, 0x10
jmp 0x49348d
push 0
push edi
mov edi, ebx
call fcn.0049cb16
mov ecx, dword [0x59376c]
mov esi, ecx
test ecx, ecx
je 0x49348d
xor eax, eax
lea edi, [ebp - 0xcfc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebx + 8]
push ecx
lea ecx, [ebp - 0xd00]
mov dword [ebp - 0xd00], 0x50536953
mov dword [ebp - 0xcf8], eax
call fcn.0048bda5
lea eax, [ebp - 0xd00]
push eax
push dword [ebp - 0xcec]
push 0x4a
push dword [0x59459c]
push esi
mov ecx, str.Q360SafeMonClass
call fcn.0048bfb0
jmp 0x49348d
cmp eax, 0x524d5345
je 0x4950f7
cmp eax, 0x524d5649
je 0x494619
cmp eax, 0x52534b56
je 0x493a2a
cmp eax, 0x53434641
je 0x4950a7
cmp eax, 0x53435343
jne 0x495879
mov esi, edi
call fcn.0049b191
jmp 0x49348d
push 0x53a3d8
lea eax, [ebp - 0xa54]
call fcn.004043d1
mov byte [ebp - 4], 0x15
mov eax, dword [ebx + 4]
test eax, eax
je 0x4950d7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4950d7
shr eax, 1
push ebx
lea esi, [ebp - 0xa54]
call fcn.00404d75
cmp dword [ebp - 0xa3c], 8
mov eax, dword [ebp - 0xa50]
jae 0x4950ec
lea eax, [ebp - 0xa50]
push eax
call fcn.00448ada
jmp 0x4935a5
cmp dword [ebx + 4], 0xc
jne 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
push 0x590f51
push 0xc
call fcn.004f5c13
mov edi, eax
xor esi, esi
pop ecx
pop ecx
cmp edi, esi
je 0x49348d
push 0xc
push ebx
push edi
call fcn.004f4830
add esp, 0xc
push esi
push esi
push edi
push 0x49a337
push esi
push esi
call fcn.004f5629
add esp, 0x18
cmp eax, esi
je 0x495154
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49348d
push edi
call fcn.004f1890
pop ecx
jmp 0x49348d
mov eax, dword [0x59376c]
xor ecx, ecx
cmp eax, ecx
je 0x49509b
lea edx, [ebp - 0xd00]
push edx
push ecx
push 0x4a
push dword [0x59459c]
mov dword [ebp - 0xcf8], ecx
mov dword [ebp - 0xcfc], ecx
push eax
mov ecx, str.Q360SafeMonClass
mov dword [ebp - 0xd00], 0x53435343
call fcn.0048bfb0
jmp 0x49509b
mov ecx, 0x54495350
cmp eax, ecx
ja 0x495639
je 0x495600
mov esi, 0x53536953
cmp eax, esi
ja 0x495383
je 0x495377
cmp eax, 0x53445043
je 0x495342
cmp eax, 0x5348524d
je 0x4952ed
cmp eax, 0x534d4150
je 0x4952cf
cmp eax, 0x53505053
je 0x49527e
cmp eax, 0x53535343
je 0x495272
cmp eax, 0x53536952
jne 0x495879
push ebx
push edi
call fcn.0049cbbc
mov ecx, dword [0x59376c]
mov dword [ebp - 0xcf8], ecx
test ecx, ecx
je 0x49348d
xor eax, eax
lea edi, [ebp - 0xd1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xd1c], eax
mov eax, dword [ebx + 8]
push ecx
lea ecx, [ebp - 0xd20]
mov dword [ebp - 0xd20], esi
mov dword [ebp - 0xd18], eax
call fcn.0048bda5
lea eax, [ebp - 0xd20]
push eax
push dword [ebp - 0xcec]
push 0x4a
push dword [0x59459c]
push dword [ebp - 0xcf8]
jmp 0x495059
mov esi, edi
call fcn.0049ab32
jmp 0x49348d
cmp dword [ebx + 4], 4
jne 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
mov ebx, dword [ebx]
mov eax, ebx
cdq
push 8
mov dword [ebp - 0xd00], eax
lea eax, [ebp - 0xd00]
push eax
push 0xb
push str.Privacy_Page_State
push str.Software360SafeAntiTrack
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xcfc], edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
call fcn.004a0930
jmp 0x49348d
mov esi, str._optimizeboot
call fcn.0044495c
cmp eax, 1
jle 0x4952e3
mov esi, str._shareboot
call fcn.004b289c
jmp 0x49348d
cmp dword [0x593800], 0
je 0x495324
cmp dword [ebx + 4], 0x200c
jne 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
xor eax, eax
lea ecx, [ebx + 0xc]
mov word [ebx + 0x200a], ax
call fcn.0049307e
jmp 0x49348d
push dword [edi + 4]
push 0xcf
push 0x111
push dword [0x5937f0]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x49348d
xor ebx, ebx
inc ebx
lea esi, [ebp - 0xcf8]
mov dword [ebp - 0xcf8], ebx
call fcn.0043703b
cmp dword [ebp - 0xcf8], ebx
sete al
mov byte [edi + 0x11a0], al
test al, al
je 0x49348d
call fcn.004a28b6
jmp 0x49348d
push ebx
push edi
call fcn.0049cbbc
jmp 0x494fdc
sub eax, 0x5354524d
je 0x495517
sub eax, 0x2f9
je 0x4954d9
sub eax, 0xf102fd
je 0x4954c8
sub eax, 0x3fb02
je 0x4953b4
sub eax, 0xa
jne 0x495879
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 0x451
push dword [edi + 4]
call esi
push 0x454
push dword [edi + 4]
call esi
and dword [edi + 0x510], 0
cmp dword [ebx], 0x54495345
jne 0x4954a6
cmp dword [ebx + 4], 4
jne 0x4941ae
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4941ae
mov eax, dword [ebx]
mov dword [edi + 0x524], eax
xor esi, esi
call fcn.00449525
lea ecx, [edi + 0x24]
mov edx, dword [ecx]
push eax
call dword [edx + 0x24]
test eax, eax
je 0x495424
push str.true
push eax
call fcn.004f5171
pop ecx
pop ecx
test eax, eax
jne 0x495424
inc esi
call fcn.0049336f
mov bl, al
test bl, bl
jne 0x495436
and dword [edi + 0x524], 0
test esi, esi
jne 0x49547f
call fcn.00448249
test eax, eax
jne 0x49547f
test bl, bl
je 0x49547f
lea ebx, [edi + 0xb68]
mov eax, ebx
call fcn.004bf2fe
lea esi, [edi + 0x980]
mov eax, esi
call fcn.004bf2fe
mov eax, dword [edi + 0x524]
test eax, eax
jne 0x495471
push 1
push eax
push ebx
jmp 0x495475
push 0
push eax
push esi
call fcn.004bf636
jmp 0x4941ae
cmp dword [edi + 0x524], 0
jbe 0x4941ae
push 0
push 0x1388
push 0x454
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4941ae
and dword [edi + 0x524], 0
lea eax, [edi + 0xb68]
call fcn.004bf2fe
lea eax, [edi + 0x980]
call fcn.004bf2fe
jmp 0x4941ae
push dword [ebx + 4]
mov ecx, dword [ebx + 8]
push edi
call fcn.004a09d5
jmp 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
push ebx
lea eax, [ebp - 0xcf8]
push eax
call fcn.004056ee
lea esi, [ebp - 0xcf8]
mov byte [ebp - 4], 3
call fcn.00428927
push eax
push 0x53545546
push edi
call fcn.00499863
mov eax, dword [ebp - 0xcf8]
jmp 0x493b4d
mov eax, dword [0x59376c]
mov esi, eax
test eax, eax
je 0x49348d
xor eax, eax
cmp word [0x594258], ax
je 0x493493
push 0x206
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.004f18b0
add esp, 0xc
push str._scan
push str.QHSafeScanner.exe
push 0x594258
push str.__s_s___s
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.004f9a1c
add esp, 0x18
test eax, eax
jge 0x495584
xor eax, eax
jmp 0x493493
push 0x53a3d8
lea eax, [ebp - 0xa74]
call fcn.004043d1
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x13
call fcn.004043d1
push 1
push 4
mov byte [ebp - 4], 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
lea ecx, [ebp - 0xa54]
lea edx, [ebp - 0xa74]
call fcn.0048bec5
push 0
lea esi, [ebp - 0xa54]
push 1
cmp eax, 1
je 0x4955f0
call fcn.00404e29
push 0
push 1
lea esi, [ebp - 0xa74]
call fcn.00404e29
jmp 0x49557d
call fcn.00404e29
lea esi, [ebp - 0xa74]
jmp 0x4935ab
push 0x454
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebx + 4], 4
jne 0x49348d
cmp dword [ebx + 8], 0
je 0x49348d
and dword [edi + 0x524], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax]
mov dword [edi + 0x520], eax
jmp 0x4941ae
mov ecx, 0x54544842
cmp eax, ecx
ja 0x49584a
je 0x495817
mov ecx, eax
sub ecx, 0x54495353
je 0x4957d2
sub ecx, 0x2f9f5
je 0x495767
sub ecx, 4
je 0x495767
sub ecx, 0x30607
je 0x495719
sub ecx, 0x3f6
je 0x494f63
sub ecx, 0x1fafd
jne 0x495879
cmp dword [ebx + 4], 0x804
jne 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
mov edi, dword [0x59376c]
test edi, edi
je 0x49348d
mov esi, 0x818
push esi
push ecx
lea eax, [ebp - 0xa38]
push eax
call fcn.004f18b0
add esp, 0xc
lea eax, [ebp - 0xa38]
push eax
push 0xa
mov edx, 0x552954
pop ecx
call fcn.0043fd87
lea eax, [ebx + 4]
push eax
push 0x400
lea edx, [ebp - 0xa24]
call fcn.0042a4a0
mov eax, dword [ebx]
and dword [ebp - 0xa28], 0
push esi
lea ecx, [ebp - 0xa38]
mov dword [ebp - 0xa2c], eax
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax]
jmp 0x49348d
cmp dword [edi + 0x2ec], 0
jne 0x49348d
lea eax, [ebp - 0xa78]
push eax
call fcn.004a456c
mov byte [ebp - 4], 0x12
mov ecx, dword [0x59376c]
test ecx, ecx
je 0x495752
mov eax, dword [ecx]
lea edx, [ebp - 0xa78]
push edx
push dword [ebx + 4]
push dword [ebx + 8]
call dword [eax + 8]
lea eax, [ebp - 0xa78]
push eax
mov byte [ebp - 4], 0
call fcn.004a45bd
jmp 0x49348d
push 4
cmp eax, 0x544c4d48
jne 0x4957a1
call fcn.004f1aab
pop ecx
mov dword [ebp - 0xcf8], eax
mov byte [ebp - 4], 0x18
test eax, eax
je 0x49578f
push dword [ebx + 8]
push eax
call fcn.004056ee
jmp 0x495791
xor eax, eax
push eax
push 0xff
push 0x882
jmp 0x495331
call fcn.004f1aab
pop ecx
mov dword [ebp - 0xcf8], eax
mov byte [ebp - 4], 0x19
test eax, eax
je 0x4957c0
push dword [ebx + 8]
push eax
call fcn.004056ee
jmp 0x4957c2
xor eax, eax
push eax
push 0xff
push 0x883
jmp 0x495331
push 0x454
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
push eax
push 0xc8
push 0x451
push dword [edi + 4]
mov dword [edi + 0x410], eax
mov dword [edi + 0x520], eax
mov dword [edi + 0x524], eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [edi + 0x510], 1
jmp 0x4941ae
cmp dword [ebx + 4], 4
jne 0x49348d
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49348d
mov eax, dword [ebx]
push 0xa
push 0
push edi
mov dword [edi + 0x10c], eax
mov byte [edi + 0x110], 1
call fcn.0049e0d0
jmp 0x49348d
cmp eax, 0x5454534d
je 0x4959d0
cmp eax, 0x5457434c
je 0x4959af
cmp eax, 0x5457534c
je 0x49598e
cmp eax, 0x63626567
je 0x4958b4
cmp eax, 0x66706567
je 0x495897
lea eax, [ebp - 0xd04]
push eax
push ebx
push dword [ebp - 0xcec]
lea ecx, [edi + 0x370]
call fcn.0047b96e
jmp 0x49348d
lea eax, [ebp - 0xd04]
push eax
push ebx
push 0
push 0x4a
add edi, 0x370
push edi
call fcn.0047b3b0
jmp 0x49348d
cmp dword [ebx + 4], 4
jne 0x49348d
mov eax, dword [ebx + 8]
test eax, eax
je 0x49348d
mov ecx, dword [edi + 0x440]
test ecx, ecx
je 0x49348d
cmp dword [edi + 0x130], 0
je 0x49348d
mov dword [ebp - 0xce4], edx
mov eax, dword [eax]
dec eax
je 0x495945
dec eax
je 0x495921
dec eax
jne 0x49348d
cmp dword [edi + 0x134], edx
jne 0x49348d
mov eax, dword [ecx]
lea edx, [ebp - 0xce4]
push edx
push ebx
push esi
push 0x4a
call dword [eax + 0x28]
cmp dword [ebp - 0xce4], 0
jmp 0x493a24
cmp dword [edi + 0x134], edx
mov eax, dword [ecx]
lea edx, [ebp - 0xce4]
push edx
push ebx
push esi
push 0x4a
jne 0x495986
call dword [eax + 0x28]
and dword [edi + 0x134], 0
jmp 0x49348d
mov eax, dword [ecx]
lea esi, [edi + 0x134]
cmp dword [esi], 0
jne 0x495976
call dword [eax + 0xc]
test eax, eax
je 0x49348d
mov edi, dword [edi + 0x440]
lea ecx, [ebp - 0xce4]
mov dword [esi], 1
mov eax, dword [edi]
push ecx
mov ecx, edi
jmp 0x49597d
lea edx, [ebp - 0xce4]
push edx
push ebx
push dword [ebp - 0xcec]
push 0x4a
call dword [eax + 0x28]
jmp 0x49348d
mov eax, dword [ebx + 8]
test eax, eax
je 0x49348d
cmp dword [ebx + 4], 0x40
jb 0x49348d
push eax
push edi
call fcn.0049c44d
jmp 0x49348d
mov eax, dword [ebx + 8]
test eax, eax
je 0x49348d
cmp dword [ebx + 4], 0x40
jb 0x49348d
push eax
push edi
call fcn.0049c5c4
jmp 0x49348d
xor esi, esi
jmp 0x4952e3