Function at 0x439c8b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x210]
push 0x208
push esi
push eax
mov ebx, ecx
mov dword [ebp - 0x26c], esi
call fcn.00463e50
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, ebx
and edi, 0x10
je 0x439ce1
call fcn.0043962a
mov esi, eax
and dword [ebp - 0x218], 0
xor eax, eax
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
test bl, 4
je 0x439dbb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x240]
push str.__ls___360chromeautoupdate___v3Wnd_d___typeupdate___v3ChromeProcId_d
push eax
call fcn.0041f460
add esp, 0x14
lea ecx, [ebp - 0x228]
push eax
call fcn.004064f0
push 0
push 1
lea ecx, [ebp - 0x240]
call fcn.004019ef
push 0x40
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x2b8], 0x44
push 0
push eax
call fcn.00463e50
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x268], xmm0
push str.__prefetch:8
call fcn.004011e1
pop ecx
push eax
push str.__prefetch:8
lea ecx, [ebp - 0x228]
call fcn.00401d59
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2b8]
push ecx
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
xor ecx, ecx
push ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test edi, edi
je 0x439ec8
and dword [ebp - 0x230], 0
lea edx, [ebp - 0x240]
xor eax, eax
mov dword [ebp - 0x22c], 7
mov ecx, 0x3ea
mov word [ebp - 0x240], ax
call fcn.00413fb0
cmp dword [ebp - 0x22c], 8
lea eax, [ebp - 0x240]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmovae eax, dword [ebp - 0x240]
push eax
call edi
push eax
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x258]
push str.__ls___360chromeautoupdate___v3Wnd_d___v3ChromeProcId_d___v3manual___typeupdate___user_data__ls_
push eax
call fcn.0041f460
add esp, 0x18
lea ecx, [ebp - 0x228]
push eax
call fcn.004064f0
push 0
push 1
lea ecx, [ebp - 0x258]
call fcn.004019ef
push 0x40
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x2b8], 0x44
push 0
push eax
call fcn.00463e50
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x268], xmm0
push str.__prefetch:8
call fcn.004011e1
pop ecx
push eax
push str.__prefetch:8
lea ecx, [ebp - 0x228]
call fcn.00401d59
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2b8]
push ecx
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
xor ecx, ecx
push ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x240]
call fcn.0040d070
jmp 0x439ece
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test bl, 0x20
je 0x439fd4
and dword [ebp - 0x230], 0
lea edx, [ebp - 0x240]
xor eax, eax
mov dword [ebp - 0x22c], 7
mov ecx, 0x3ea
mov word [ebp - 0x240], ax
call fcn.00413fb0
cmp dword [ebp - 0x22c], 8
lea eax, [ebp - 0x240]
cmovae eax, dword [ebp - 0x240]
push eax
call edi
push eax
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x258]
push str.__ls___360chromeautoupdate___v3Wnd_d___v3ChromeProcId_d___v3manual___beta___typeupdate___user_data__ls_
push eax
call fcn.0041f460
add esp, 0x18
lea ecx, [ebp - 0x228]
push eax
call fcn.004064f0
push 0
push 1
lea ecx, [ebp - 0x258]
call fcn.004019ef
push 0x40
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x2b8], 0x44
push 0
push eax
call fcn.00463e50
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x268], xmm0
push str.__prefetch:8
call fcn.004011e1
pop ecx
push eax
push str.__prefetch:8
lea ecx, [ebp - 0x228]
call fcn.00401d59
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2b8]
push ecx
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
xor ecx, ecx
push ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x240]
call fcn.0040d070
test bl, 1
jne 0x439fe5
mov eax, ebx
and al, 0xc
cmp al, 4
jne 0x43a098
call edi
push eax
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x258]
push str.__ls___360chrome_safe_browsing_autoupdate___v3Wnd_d___typeupdate___v3ChromeProcId_d
push eax
call fcn.0041f460
add esp, 0x14
lea ecx, [ebp - 0x228]
push eax
call fcn.004064f0
push 0
push 1
lea ecx, [ebp - 0x258]
call fcn.004019ef
push 0x40
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x2b8], 0x44
push 0
push eax
call fcn.00463e50
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x268], xmm0
push str.__prefetch:8
call fcn.004011e1
pop ecx
push eax
push str.__prefetch:8
lea ecx, [ebp - 0x228]
call fcn.00401d59
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2b8]
push ecx
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
xor ecx, ecx
push ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test bl, 2
jne 0x43a0a9
and bl, 0xc
cmp bl, 4
jne 0x43a159
call edi
push eax
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x258]
push str.__ls___360chrome_safe_browsing_white___v3Wnd_d___typeupdate___v3ChromeProcId_d
push eax
call fcn.0041f460
add esp, 0x14
lea ecx, [ebp - 0x228]
push eax
call fcn.004064f0
xor ebx, ebx
lea ecx, [ebp - 0x258]
push ebx
push 1
call fcn.004019ef
mov edi, str.__prefetch:8
push edi
call fcn.004011e1
pop ecx
push eax
push edi
lea ecx, [ebp - 0x228]
call fcn.00401d59
push 0x40
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x2b8], 0x44
push ebx
push eax
call fcn.00463e50
add esp, 0xc
lea ecx, [ebp - 0x268]
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
xorps xmm0, xmm0
cmovae eax, dword [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x2b8]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
movups xmmword [ebp - 0x268], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x43a15b
xor ebx, ebx
test esi, esi
jne 0x43a163
mov esi, ebx
jmp 0x43a198
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x43a185
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push esi
lea eax, [ebp - 0x2d4]
push eax
call edi
test eax, eax
jne 0x43a16b
xor esi, esi
inc esi
push ebx
push 1
lea ecx, [ebp - 0x228]
call fcn.004019ef
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460c27
mov esp, ebp
pop ebp
ret