Function at 0x401227
Capabilities:
Allocate or change rwx memory
Resume thread
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8dc
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x2f4]
push eax
push 0
push 1
push 0x14
call sub.ntdll.dll_RtlAdjustPrivilege
lea eax, [ebp - 0x2f4]
push eax
push 0
push 1
push 0xa
call sub.ntdll.dll_RtlAdjustPrivilege
push 0x40
push 0x4020a0
push 0x402080
push 0
call sub.user32.dll_MessageBoxA
push 8
lea eax, [ebp - 0x2fc]
push eax
call sub.ntdll.dll_RtlZeroMemory
push 0x18
lea eax, [ebp - 0x314]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov dword [ebp - 0x314], 0x18
push str.360Safe.exe
call section..text
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x2d8], 0
lea eax, [ebp - 0x2fc]
push eax
lea eax, [ebp - 0x314]
push eax
push 0x1f0fff
lea eax, [ebp - 0x2d8]
push eax
call sub.ntdll.dll_NtOpenProcess
or eax, eax
jne 0x401534
push 0x40
push 0x4020dd
push 0x4020b5
push 0
call sub.user32.dll_MessageBoxA
mov dword [ebp - 0x2e8], 0x1000
mov dword [ebp - 0x2e4], 0
push 0x40
push 0x1000
lea eax, [ebp - 0x2e8]
push eax
push 0
lea eax, [ebp - 0x2e4]
push eax
push dword [ebp - 0x2d8]
call sub.ntdll.dll_NtAllocateVirtualMemory
or eax, eax
jne 0x401529
push 0x40
push 0x40210e
push 0x4020e6
push 0
call sub.user32.dll_MessageBoxA
mov dword [ebp - 0x2ec], 0
lea eax, [ebp - 0x2ec]
push eax
push 0x400
lea eax, [ebp - 0x714]
push eax
push dword [ebp - 0x2e4]
push dword [ebp - 0x2d8]
call sub.ntdll.dll_NtReadVirtualMemory
or eax, eax
jne 0x4014ee
push 0x40
push 0x40213f
push 0x402117
push 0
call sub.user32.dll_MessageBoxA
lea eax, [ebp - 0x2f0]
push eax
push 0x400
lea eax, [ebp - 0x714]
push eax
push dword [ebp - 0x2e4]
push dword [ebp - 0x2d8]
call sub.ntdll.dll_NtWriteVirtualMemory
or eax, eax
jne 0x4014ee
push 8
lea eax, [ebp - 0x2fc]
push eax
call sub.ntdll.dll_RtlZeroMemory
push 0x18
lea eax, [ebp - 0x314]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov dword [ebp - 0x314], 0x18
mov dword [ebp - 0x2f8], 0xfffffffe
mov dword [ebp - 0x2e0], 0
push 0x40
push 0x402168
push 0x402148
push 0
call sub.user32.dll_MessageBoxA
lea eax, [ebp - 0x2fc]
push eax
lea eax, [ebp - 0x314]
push eax
push 0x1f03ff
lea eax, [ebp - 0x2e0]
push eax
call sub.ntdll.dll_NtOpenThread
or eax, eax
jne 0x4014ee
push 0x40
push 0x402191
push 0x402171
push 0
call sub.user32.dll_MessageBoxA
lea eax, [ebp - 0x2dc]
push eax
push dword [ebp - 0x2e0]
call sub.ntdll.dll_NtSuspendThread
or eax, eax
jne 0x4014e3
push 0x40
push 0x4021be
push 0x40219a
push 0
call sub.user32.dll_MessageBoxA
push 0x2cc
lea eax, [ebp - 0x2cc]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov dword [ebp - 0x2cc], 0x10007
lea eax, [ebp - 0x2cc]
push eax
push dword [ebp - 0x2e0]
call sub.ntdll.dll_NtGetContextThread
or eax, eax
jne 0x4014be
push 0x40
push 0x4021eb
push 0x4021c7
push 0
call sub.user32.dll_MessageBoxA
lea eax, [ebp - 0x2cc]
push eax
push dword [ebp - 0x2e0]
call sub.ntdll.dll_NtSetContextThread
push 0x40
push 0x402214
push 0x4021f4
push 0
call sub.user32.dll_MessageBoxA
lea eax, [ebp - 0x2dc]
push eax
push dword [ebp - 0x2e0]
call sub.ntdll.dll_NtResumeThread
push dword [ebp - 0x2e0]
call sub.ntdll.dll_NtClose
push 0x40
push 0x402245
push 0x40221d
push 0
call sub.user32.dll_MessageBoxA
mov dword [ebp - 0x2e8], 0
push 0x8000
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x2e4]
push eax
push dword [ebp - 0x2d8]
call sub.ntdll.dll_NtFreeVirtualMemory
push dword [ebp - 0x2d8]
call sub.ntdll.dll_NtClose
push 0
push 0xffffffffffffffff
call sub.ntdll.dll_NtTerminateProcess
leave
ret