Function at 0x446020
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
push 0xffffffffffffffff
push 0x58bf28
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x603df8
mov dword [esp + 0x14], 0x603db0
call fcn.004030f0
xor ebx, ebx
mov dword [esp + 0x1c], ebx
push 0x603dfc
call fcn.004030f0
mov byte [esp + 0x1c], 1
push 0x445c80
push 0x445c20
mov edi, 0xa
push edi
push 8
push 0x603e40
call fcn.004a5c6f
mov byte [esp + 0x1c], 2
push 0x445c80
push 0x445c20
push 0x14
push 8
push 0x603e94
call fcn.004a5c6f
mov byte [esp + 0x1c], 3
push 0x6041a8
call fcn.004030f0
mov byte [esp + 0x1c], 4
push 0x6041ac
call fcn.004030f0
mov byte [esp + 0x1c], 5
push 0x6041b0
call fcn.004030f0
mov byte [esp + 0x1c], 6
push 0x6041b4
call fcn.004030f0
mov byte [esp + 0x1c], 7
push 0x6041b8
call fcn.004030f0
mov byte [esp + 0x1c], 8
push 0x6041bc
call fcn.004030f0
mov byte [esp + 0x1c], 9
push 0x6041d4
call fcn.00462370
mov byte [esp + 0x1c], 0xa
push 0x6041ec
call fcn.00462370
mov byte [esp + 0x1c], 0xb
push 0x604204
call fcn.00462370
mov byte [esp + 0x1c], 0xc
push 0x60421c
call fcn.00462370
mov byte [esp + 0x1c], 0xd
push 0x604234
call fcn.00462370
mov byte [esp + 0x1c], 0xe
push 0x60424c
call fcn.00462370
mov byte [esp + 0x1c], 0xf
push 0x604264
call fcn.00462370
mov byte [esp + 0x1c], 0x10
push 0x60427c
call fcn.00462370
mov byte [esp + 0x1c], 0x11
push 0x604294
call fcn.00462370
mov byte [esp + 0x1c], 0x12
push 0x6042ac
call fcn.00462370
mov byte [esp + 0x1c], 0x13
push 0x6042c4
call fcn.00445ce0
mov byte [esp + 0x1c], 0x14
push 0x6042e4
call fcn.00462370
mov byte [esp + 0x1c], 0x15
push 0x60432c
call fcn.004030f0
mov byte [esp + 0x1c], 0x16
push 0x604334
call fcn.004030f0
mov byte [esp + 0x1c], 0x17
push 0x604338
call fcn.004030f0
mov byte [esp + 0x1c], 0x18
push 0x60433c
call fcn.004030f0
mov byte [esp + 0x1c], 0x19
push 0x604358
call fcn.00462370
mov byte [esp + 0x1c], 0x1a
push 0x604370
call fcn.004030f0
mov byte [esp + 0x1c], 0x1b
push 0x604378
call fcn.00462370
mov byte [esp + 0x1c], 0x1c
push 0x604394
call fcn.0043df10
mov byte [esp + 0x1c], 0x1d
push 0x6043b4
call fcn.0043df10
mov byte [esp + 0x1c], 0x1e
mov dword [0x6043d4], ebx
mov dword [0x6043d8], ebx
mov dword [0x6043dc], ebx
mov byte [esp + 0x1c], 0x1f
push 0x6043e0
call fcn.00462370
mov byte [esp + 0x1c], 0x20
push 0x6043f8
call fcn.004030f0
mov byte [esp + 0x1c], 0x21
push 0x6043fc
call fcn.004030f0
mov byte [esp + 0x1c], 0x22
push 0x604400
call fcn.004030f0
mov byte [esp + 0x1c], 0x23
push 0x604404
call fcn.004030f0
mov byte [esp + 0x1c], 0x24
mov dword [0x603db0], 0x50
mov esi, 1
mov eax, 0x78
mov edx, 0x1e
mov ecx, 0x15180
mov dword [0x604320], edi
mov dword [0x603dd8], eax
mov dword [0x6041c8], eax
mov dword [0x60434c], edi
mov dword [0x604350], eax
push 0x5d2b98
xor edi, edi
mov eax, 0x60432c
mov dword [0x603db4], esi
mov dword [0x603dbc], esi
mov dword [0x603dc0], esi
mov dword [0x603dcc], ebx
mov dword [0x603dc4], edx
mov dword [0x603dc8], esi
mov dword [0x603dd0], ebx
mov dword [0x604308], esi
mov dword [0x6042fc], 0x258
mov dword [0x604300], 0x7080
mov dword [0x604304], esi
mov dword [0x603db8], 0x2000
mov dword [0x60430c], 5
mov dword [0x604310], 0x63
mov dword [0x604328], ebx
mov dword [0x604314], 0x3c
mov dword [0x603e00], 0x800
mov dword [0x603e04], 0xc800
mov dword [0x604318], 0x3f480
mov dword [0x60431c], ecx
mov dword [0x603e08], 0x7530
mov dword [0x604324], 0x32
mov dword [0x603e10], ebx
mov dword [0x603e14], ebx
mov dword [0x603e18], ebx
mov dword [0x603e1c], ebx
mov dword [0x603e24], ebx
mov dword [0x603e20], ebx
mov dword [0x603e0c], 0xc350
mov dword [0x603e28], 0x28
mov dword [0x603e2c], ebx
mov dword [0x603e30], ebx
mov dword [0x603e34], 0x14
mov dword [0x604194], 0x20000000
mov dword [0x604198], 0x3200000
mov dword [0x60419c], ecx
mov dword [0x603e38], 0x708
mov dword [0x603e3c], edx
mov dword [0x6041c0], ebx
mov dword [0x603e90], ebx
mov dword [0x603f34], ebx
mov dword [0x6041c4], ebx
mov dword [0x6041cc], 0x14
mov dword [0x6041d0], 6
mov dword [0x604348], ebx
mov dword [0x604340], esi
call fcn.004033b0
mov eax, 0x50
mov word [0x604330], ax
push 0x5d2b98
mov eax, 0x604334
call fcn.004033b0
push 0x5d2b98
mov eax, 0x604338
call fcn.004033b0
push 0x5d2b98
mov eax, 0x60433c
call fcn.004033b0
mov eax, 0x1000000
mov dword [0x604344], ebx
mov dword [0x603ddc], eax
mov dword [0x603de0], 0x800000
mov dword [0x603de4], eax
mov dword [0x603df0], 0x40000000
mov dword [0x603de8], eax
mov dword [0x603dec], eax
mov dword [0x604390], ebx
mov dword [0x604354], ebx
mov dword [0x604374], ebx
mov dword [0x6041a0], esi
push str._a_href_http:___s_install_360EntInst__s__d_.exe__http:___s_install_360EntInst__s__d_.exe__a_
lea edi, [ebx + 0x5d]
mov eax, 0x6043f8
mov dword [0x6041a4], ebx
call fcn.004033b0
push str._IP_
lea edi, [ebx + 4]
mov eax, 0x6043fc
call fcn.004033b0
push 0x12c
push ebx
push 0x603f3a
mov byte [0x603f38], bl
mov byte [0x603f39], bl
call fcn.004add60
push 0x12c
push ebx
push 0x604066
call fcn.004add60
add esp, 0x18
mov dword [esp + 0x1c], 0xffffffff
mov eax, 0x603db0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret